PaperlayerView exact revision on arXiv

Source-linked AI summary

PhishAri: Automatic Realtime Phishing Detection on Twitter

Anupama Aggarwal, Ashwin Rajadesingan, Ponnurangam Kumaraguru

arXiv:1301.6899v1cs.SIphysics.soc-ph

TL;DR

Phishing on Twitter is difficult to detect because links spread quickly through short, URL-obfuscated content. PhishAri combines Twitter-specific, URL, and WHOIS features with machine learning, achieving high reported accuracy and realtime deployment through an API and Chrome extension.

  • Problem

    Twitter phishing is hard to detect because information spreads quickly, tweets are short, and URLs can be shortened to obscure targets and evade blacklists.

  • Method

    PhishAri combines tweet, Twitter-user, URL, and WHOIS features with machine-learning classification and deploys the detector through an API and Chrome extension.

  • Results

    PhishAri achieves 92.31% correct detection of phishing tweets, while misclassifying 9.6% of legitimate tweets as phishing.

  • Takeaways & Limitations

    PhishAri provides a realtime, usable Twitter phishing detector that is reported as more efficient than plain blacklisting and detects more phishing tweets than Twitter’s mechanism.

Abstract

from arXiv · show

With the advent of online social media, phishers have started using social networks like Twitter, Facebook, and Foursquare to spread phishing scams. Twitter is an immensely popular micro-blogging network where people post short messages of 140 characters called tweets. It has over 100 million active users who post about 200 million tweets everyday. Phishers have started using Twitter as a medium to spread phishing because of this vast information dissemination. Further, it is difficult to detect phishing on Twitter unlike emails because of the quick spread of phishing links in the network, short size of the content, and use of URL obfuscation to shorten the URL. Our technique, PhishAri, detects phishing on Twitter in realtime. We use Twitter specific features along with URL features to detect whether a tweet posted with a URL is phishing or not. Some of the Twitter specific features we use are tweet content and its characteristics like length, hashtags, and mentions. Other Twitter features used are the characteristics of the Twitter user posting the tweet such as age of the account, number of tweets, and the follower-followee ratio. These Twitter specific features coupled with URL based features prove to be a strong mechanism to detect phishing tweets. We use machine learning classification techniques and detect phishing tweets with an accuracy of 92.52%. We have deployed our system for end-users by providing an easy to use Chrome browser extension which works in realtime and classifies a tweet as phishing or safe. We show that we are able to detect phishing tweets at zero hour with high accuracy which is much faster than public blacklists and as well as Twitter's own defense mechanism to detect malicious content. To the best of our knowledge, this is the first realtime, comprehensive and usable system to detect phishing on Twitter.

I. INTRODUCTION

PhishAri addresses the challenge of detecting phishing on Twitter, where rapid information spread, limited tweet length, and shortened URLs complicate detection. It combines Twitter, URL, and user features with machine learning and provides realtime end-user protection.

  • Motivation: Social-media phishing is difficult to detect because of high data volume, limited text, rapidly changing content, and shortened URLs.Short URLs can hide targets and help evade blacklists.
  • Approach: PhishAri combines suspicious-URL, tweet-content, Twitter-user, and phishing-domain features to classify tweets as phishing or safe.The system applies machine-learning classification to these combined features.
  • Results: 92.52% accuracy and an average detection time of 0.425 seconds support realtime phishing detection.The reported computation time is presented as suitable for real-world use.
  • Results: PhishAri is reported as more efficient than plain blacklist lookup and detects more phishing tweets than Twitter’s own mechanism.The paper attributes Twitter’s vulnerability partly to URL shorteners and multiple redirections.
  • Deployment: The work includes a Chrome browser extension and API intended for use by real-world Twitter users.The extension marks phishing tweets with a red indicator.

II. RELATED WORK

Prior work addressed phishing detection in email and webpages, while Twitter research mainly focused on spam or suspicious URLs. PhishAri builds on these directions for realtime Twitter phishing detection.

  • Email and webpage detection: Email phishing detectors have used machine-learning features such as URL age, URL dots, and email HTML content.One cited email approach reported 99.5% accuracy.
  • Email and webpage detection: URL-only features can become less effective when attackers change their strategies.Related webpage approaches also examine website content and search-engine indexing.

B. Phishing and spamming on Online Social Media

Social-media phishing exploits large, trusted information networks and is difficult to detect in realtime. PhishAri collects URL-containing tweets, labels them with phishing databases, and combines Twitter-specific detection with a deployable system.

  • Motivation: Social-media phishing has increased as platforms make information easy to spread, creating a need for protective technology.The cited discussion reports phishing activity across social networks and describes Twitter’s spam URL clickthrough rate as 0.13%.
  • Motivation: Twitter-specific challenges include rapid information spread, character limitations, shortened URLs, and the need for realtime detection.These constraints make Twitter phishing distinct from conventional email or webpage detection.
  • System: PhishAri combines blacklisting with Twitter-, URL-, and WHOIS-based features in a realtime API and browser extension.The deployed extension displays an indicator next to each tweet’s classification.
  • Data collection: Tweets were initially labeled by querying each URL against the PhishTank and Google Safebrowsing databases.These services supplied phishing or legitimate URL labels for the annotated dataset.
  • Data collection: The study collected tweets containing URLs through Twitter’s Streaming API, obtaining 309,321 tweets between 1 February and 19 April 2012.The API’s rate limit restricted the number of tweets collected per hour.

B. Labeling Tweets as Phishing or Legitimate

PhishAri labels tweets using blacklist declarations from PhishTank, Google Safebrowsing, Twitter, and Bitly, while recognizing that blacklists can be slow to capture malicious URLs. The resulting dataset contains 1,589 phishing tweets among 309,321 analyzed tweets.

  • Labeling Tweets as Phishing or Legitimate: PhishAri labels a tweet as phishing when its URL is identified by PhishTank or Google Safebrowsing.PhishTank is crowdsourced, while Google Safebrowsing matches queried URL hashes against its database.
  • Labeling Tweets as Phishing or Legitimate: Blacklist-based labeling is constrained because blacklists are slow to capture malicious URLs.
  • Labeling Tweets as Phishing or Legitimate: Tweets flagged by Twitter or Bitly as phishing are also marked phishing, while URLs not identified by these services are marked safe.
  • Labeling Tweets as Phishing or Legitimate: 1,589 phishing tweets with 903 unique URLs were obtained from 309,321 analyzed tweets.
  • Labeling Tweets as Phishing or Legitimate: The broader detection methodology combines URL, tweet, network, and WHOIS feature categories.

C. Tweet based Features

PhishAri uses tweet and user-network characteristics to support realtime phishing detection on Twitter. These features account for how malicious tweets gain visibility and how suspicious users behave.

  • Tweet based Features: Tweet-based features include hashtags and mention tags, which can increase a malicious tweet’s visibility.
  • Tweet based Features: Twitter’s follower and followee relationships are unidirectional and determine whose tweets appear in a user’s timeline.
  • Tweet based Features: Spammers often post automated tweets in large numbers at predefined intervals and may have many followees but few followers.
  • Tweet based Features: The system provides realtime protection through a browser extension and supporting API that identify tweets as phishing or safe.
  • Tweet based Features: The extension integrates detection results into Twitter pages without extra clicks, using green indicators for safe tweets and red indicators for phishing tweets.

B. PhishAri API

The PhishAri API receives tweet identifiers, extracts URL and Twitter-related features, classifies tweets with a trained model, and returns phishing or safe results to the browser extension.

  • PhishAri API: The RESTful PhishAri API is implemented in Python and hosted on an Intel Xeon Ubuntu server.The server has a 16-core 2.67 GHz processor and 32 GB RAM.
  • PhishAri API: The API accepts tweet submissions through a POST method and classifies URLs using a pre-loaded trained classifier.
  • PhishAri API: Independent feature-extraction modules run simultaneously to reduce processing time for realtime indications.
  • PhishAri API: The extension sends tweet IDs to the API, which constructs a feature vector from URL, user, and Twitter-network information for classification.
  • PhishAri API: The API returns a JSON result indicating whether the tweet is phishing or safe, enabling corresponding browser indicators.
  • PhishAri API: The classification pipeline labels URL-containing tweets, trains a model, and applies it to newly appeared URLs.

1) Naive Bayes:

PhishAri evaluates multiple machine-learning classifiers for phishing-tweet detection and deploys the trained model through its API and Chrome extension. Results are computed using five-fold cross-validation.

  • 1) Naive Bayes:: Naive Bayes classifies tweets probabilistically by selecting the category with the highest feature-based likelihood.
  • 1) Naive Bayes:: Decision trees predict tweet categories using simple decision rules inferred from data features.
  • 1) Naive Bayes:: Random Forest randomly selects feature subsets for classification to improve predictive accuracy and control over-fitting.
  • 1) Naive Bayes:: 5-fold cross-validation averages results across five runs, training on four subsets and testing on the remaining subset each time.
  • 1) Naive Bayes:: The PhishAri API uses a trained model to classify incoming tweets, while the Chrome extension displays color-coded phishing or safe markers.

A. Evaluation Metrics

The study evaluates phishing-tweet classifiers using precision, recall, and accuracy derived from a confusion matrix and five-fold cross-validation. Random Forest performs best, achieving 92.52% accuracy on the selected dataset.

  • Metrics: Precision, recall, and accuracy are used to evaluate classification effectiveness.Precision measures correctly predicted positives among predicted positives, recall measures detected actual positives, and accuracy measures correctly classified tweets overall.
  • Classification results: 92.52% accuracy was achieved by Random Forest, which performed best among Naive Bayes, Decision Trees, and Random Forest.The evaluation used 1,473 unique phishing tweets and 1,500 randomly selected safe tweets.
  • Classification results: 92.21% recall was obtained for phishing tweets and 96.82% recall for safe tweets with Random Forest.The authors also report 92.31% of phishing tweets correctly detected, while 9.6% of legitimate tweets were misclassified as phishing and 7.78% of phishing tweets as legitimate.

C. Evaluation of various Feature Sets

The evaluation tests Twitter-specific features alongside URL-based features for zero-hour phishing detection. Random Forest classification reaches 92.52% overall accuracy, while several tweet and account characteristics emerge as informative signals.

  • Feature-set evaluation: 92.52% overall accuracy is achieved by Random Forest using the evaluated feature sets, compared with 82.22% using only URL-based features.The experiments add feature sets iteratively to assess their impact on classification performance.
  • Informative features: Ownership period is among the most important signals because malicious domains and phishing-related Twitter accounts tend to be short-lived.The paper links short domain lifetimes to evading detection and younger accounts to subsequent suspension.
  • Informative features: Conditional redirects help identify malicious sites when browser and bot simulations receive different landing URLs.A redirect to a legitimate site for automated access is treated as a strong indication of malicious behavior.
  • Informative features: Trending hashtags are informative because phishers append hijacked topics to unrelated tweets to increase visibility.Location-specific trending topics are displayed prominently on users’ Twitter homepages.
  • Informative features: Frequent direct mentions are informative because phishers use @tags to place links in targeted users’ timelines.The paper also identifies skewed follower-followee relationships as characteristic of phishing accounts.

E. Comparison of PhishAri with Blacklists

PhishAri is evaluated against public blacklists and Twitter’s detection mechanism for realtime phishing detection. It identifies many phishing tweets at zero hour, while classification speed and tweet characteristics are also examined.

  • Blacklist comparison: 80.6% of unique phishing tweets were detected by PhishAri at zero hour but were caught by blacklists only after three days.The comparison used Google Safebrowsing and PhishTank.
  • Twitter comparison: 84.6% of phishing tweets missed by Twitter initially were detected by PhishAri at zero hour.Among 3,09,321 tweets with URLs, 492 were initially undetected by Twitter but later marked suspicious.
  • Classification speed: 0.522 seconds was the maximum feature-extraction and classification time, with an average of 0.425 seconds and median of 0.384 seconds.The measured speed depended also on Twitter API, WHOIS, and Internet response times and bandwidth.
  • Tweet characteristics: Phishing tweets use a limited, campaign-specific vocabulary, whereas legitimate tweets contain more varied words and may reflect trending hashtags.Phishing campaigns can repeatedly use lure terms and trending hashtags to gain visibility.
  • Origin of phishing tweets: USA had the most users posting phishing URLs in the dataset, followed by Brazil.The authors caution that locations may be falsely selected in Twitter bios and may reflect the large US user population.

VIII. PHISHARI EXTENSION FOR CHROME BROWSER

The Chrome extension was evaluated through a lab study and usage statistics to assess usability and realtime indicator display. Users generally found it easy to use, although browser-only support and delays during trending-topic streams were reported.

  • User study: 10 active Twitter users participated in the lab study, and all found the extension very easy to use.The study included 7 males and 3 females.
  • Realtime experience: All 10 users saw color-coded indicators appear without visible delay when tweets loaded.Five users nevertheless observed lag while browsing a trending topic’s tweet stream.
  • Realtime experience: 5 users observed a time lag in indicator appearance during trending-topic streams.The authors planned to improve speed for this use case.
  • Platform scope: 4 users preferred Twitter clients over browser access, which the extension supports exclusively.The extension had more than 70 active users at the time of evaluation.
  • Perceived usefulness: Except for those four users, participants said PhishAri seemed useful for daily use.Users also requested spam detection for tweets without URLs, outside the current scope.
  • Usage statistics: The extension attracted users from multiple countries, with the highest traffic from the US and India.Google Analytics was used to track country and active-time statistics.

IX. DISCUSSION

The discussion describes design choices that support realtime detection, including feature selection, parallel computation, and API access. It also identifies future improvements and a current limitation to public-user tweets.

  • Feature selection: PhishAri discarded features requiring analysis of all source-user tweets to favor faster realtime performance.The system retained faster Twitter user-specific features instead.
  • Parallel computation: Parallel feature extraction reduces overall computation time, although distributing computation across multiple servers remains future work.The implementation uses multiprocessing modules.
  • API availability: The RESTful API accepts a tweet ID through an HTTP POST request and can support applications deciding whether a tweet is phishing.The API had not yet been publicly released at the time described.
  • Scope limitation: PhishAri currently detects phishing only when the source Twitter user is public because private-user information cannot be extracted.The authors propose Twitter OAuth integration to broaden coverage.
  • Overall contribution: The reported system combines URL, Twitter, and WHOIS features, provides API and Chrome-extension interfaces, and outperforms blacklists and Twitter’s defense at zero hour.The conclusion reports 92.52% accuracy, 80.6% more URLs detected than popular blacklists, and 84.6% better detection than Twitter’s defense at zero hour.
Loading 1301.6899v1…